@astrale-os/adapter-cloudflare 0.5.0-beta.19 → 0.5.0-beta.20

package/README.md

@@ -2,10 +2,10 @@
 
 Cloudflare Worker deployment adapter for Astrale Domains.
 
-During the SDK beta program, install the beta cohort explicitly:
+During the SDK beta program, install the beta package set explicitly:
 
 ```bash
 npm install @astrale-os/sdk@beta @astrale-os/adapter-cloudflare@beta
 ```
 
-Bare installs return to stable releases when the cohort is promoted and npm `latest` advances.
+Bare installs return to stable releases when the package set is promoted and npm `latest` advances.

package/dist/adapter.d.ts

@@ -1,20 +1,17 @@
-import { type Release } from '@astrale-os/sdk/deployment/release';
+import type { Release } from '@astrale-os/sdk/deployment/release';
 import { verifyReadiness } from '@astrale-os/sdk/deployment/verify';
 import type { CloudflareParams } from './params.js';
-import { artifact, materialize } from './build/artifact.js';
+import { artifact } from './build/artifact.js';
 import { startFrontend } from './build/frontend-v1.js';
-import { bulkPutSecrets, runWranglerDeploymentStatus, runWranglerDeploy, runWranglerDev } from './build/wrangler-cli.js';
-export interface CloudflareDependencies {
+import { runWranglerDev } from './build/wrangler-cli.js';
+import { type CloudflareDeployDependencies } from './deploy/index.js';
+import { signingIdentity } from './identity/source.js';
+export interface CloudflareDependencies extends CloudflareDeployDependencies {
     readonly artifact: typeof artifact;
-    readonly materialize: typeof materialize;
-    readonly runWranglerDeploy: typeof runWranglerDeploy;
-    readonly runWranglerDeploymentStatus: typeof runWranglerDeploymentStatus;
     readonly runWranglerDev: typeof runWranglerDev;
-    readonly bulkPutSecrets: typeof bulkPutSecrets;
     readonly startFrontend: typeof startFrontend;
-    readonly waitForReadiness: (release: Release) => Promise<void>;
+    readonly signingIdentity: typeof signingIdentity;
 }
 export declare function cloudflare(environments: Readonly<Record<string, CloudflareParams>>): import("@astrale-os/sdk/deployment/adapter").Adapter<CloudflareParams>;
 export declare function cloudflareWithDependencies(environments: Readonly<Record<string, CloudflareParams>>, dependencies: CloudflareDependencies): import("@astrale-os/sdk/deployment/adapter").Adapter<CloudflareParams>;
 export declare function waitForReadiness(verify: typeof verifyReadiness, release: Release): Promise<void>;
-//# sourceMappingURL=adapter.d.ts.map

package/dist/adapter.js

@@ -1,5 +1,4 @@
 import { defineAdapter } from '@astrale-os/sdk/deployment/adapter';
-import { addressing, assemble, } from '@astrale-os/sdk/deployment/release';
 import { verifyReadiness } from '@astrale-os/sdk/deployment/verify';
 import { writeFile } from 'node:fs/promises';
 import { createRequire } from 'node:module';
@@ -8,19 +7,23 @@ import { artifact, materialize } from './build/artifact.js';
 import { generateWranglerConfig } from './build/codegen/wrangler.js';
 import { resolveRouter, workerName } from './build/configuration.js';
 import { startFrontend } from './build/frontend-v1.js';
-import { bulkPutSecrets, runWranglerDeploymentStatus, runWranglerDeploy, runWranglerDev, WranglerDeployError, } from './build/wrangler-cli.js';
-const NONE = Object.freeze({ kind: 'none' });
+import { ensureWranglerDispatchNamespace, runWranglerDeploymentStatus, runWranglerDeploy, runWranglerDev, runWranglerReleaseDeploy, } from './build/wrangler-cli.js';
+import { deployCloudflare } from './deploy/index.js';
+import { signingIdentitySecrets } from './identity/secret.js';
+import { signingIdentity } from './identity/source.js';
 const packageVersion = createRequire(import.meta.url)('../package.json')
     .version;
 export function cloudflare(environments) {
     return cloudflareWithDependencies(environments, {
         artifact,
         materialize,
+        ensureWranglerDispatchNamespace,
         runWranglerDeploy,
+        runWranglerReleaseDeploy,
         runWranglerDeploymentStatus,
         runWranglerDev,
-        bulkPutSecrets,
         startFrontend,
+        signingIdentity,
         waitForReadiness: (release) => waitForReadiness(verifyReadiness, release),
     });
 }
@@ -31,6 +34,13 @@ export function cloudflareWithDependencies(environments, dependencies) {
         environments,
         prepare: dependencies.artifact,
         async watch(parameters, context) {
+            const identity = await dependencies.signingIdentity({
+                projectDir: context.projectDir,
+                source: parameters.signingIdentity,
+                origin: context.artifact.build.schema.compiled.root.origin,
+                mode: 'local',
+            });
+            const secrets = signingIdentitySecrets(context.secrets, identity);
             const directory = join(context.projectDir, '.astrale', 'runtime');
             await dependencies.materialize(directory, context.artifact.files);
             const frontend = await dependencies.startFrontend({
@@ -44,10 +54,10 @@ export function cloudflareWithDependencies(environments, dependencies) {
                 workerName: name,
                 vars: {
                     ...parameters.vars,
-                    ...context.secrets,
                     ...(parameters.host === undefined ? {} : { WORKER_URL: parameters.host }),
                     ...(frontend === undefined ? {} : { FRONTEND_DEV_URL: frontend.url }),
                 },
+                secretBindings: Object.keys(secrets).sort(),
                 ...(context.artifact.build.frontend?.source.kind === 'vite'
                     ? {
                         frontend: {
@@ -70,6 +80,7 @@ export function cloudflareWithDependencies(environments, dependencies) {
                     configPath,
                     port: parameters.port ?? 8787,
                     remote: parameters.remote ?? false,
+                    secrets,
                     autoPickPort: parameters.port === undefined,
                     ...(parameters.host === undefined ? {} : { ip: '0.0.0.0' }),
                     onReload: context.onReload,
@@ -96,185 +107,10 @@ export function cloudflareWithDependencies(environments, dependencies) {
                 },
             });
         },
-        async deploy(parameters, context) {
-            const directory = join(context.projectDir, '.astrale', 'deploy');
-            await dependencies.materialize(directory, context.artifact.files);
-            const name = workerName(parameters, context.artifact.build.schema.compiled.root.origin);
-            const configPath = join(directory, 'wrangler.jsonc');
-            const fallbackConfigPath = join(directory, 'wrangler.no-self.jsonc');
-            let deployed;
-            try {
-                deployed = await dependencies.runWranglerDeploy({
-                    projectDir: context.projectDir,
-                    configPath,
-                    fallbackConfigPath,
-                    workerName: name,
-                    ...(parameters.route === undefined ? {} : { route: parameters.route }),
-                });
-            }
-            catch (cause) {
-                const provider = cause instanceof WranglerDeployError && cause.applied !== undefined
-                    ? partialProvider(cause, context.artifact)
-                    : { kind: 'unknown' };
-                return failed('provider', progress({ provider }), cause);
-            }
-            const submitted = Object.freeze({
-                provider: 'cloudflare',
-                deployment: deployed.deploymentVersion,
-                artifact: context.artifact.digest,
-            });
-            let selected;
-            try {
-                selected = observeAddressing(context.artifact, deployed.url, name);
-            }
-            catch (cause) {
-                return failed('addressing', progress({ provider: { kind: 'partial', evidence: submitted } }), cause);
-            }
-            let observed;
-            try {
-                observed = await dependencies.runWranglerDeploymentStatus({
-                    projectDir: context.projectDir,
-                    configPath,
-                    workerName: name,
-                });
-                requireCurrentDeployment(observed, deployed.deploymentVersion);
-            }
-            catch (cause) {
-                return failed('readiness', progress({
-                    provider: {
-                        kind: 'partial',
-                        evidence: { ...submitted, issuer: selected.issuer },
-                    },
-                }), cause);
-            }
-            let provider = Object.freeze({
-                kind: 'applied',
-                evidence: Object.freeze({
-                    provider: 'cloudflare',
-                    deployment: observed.deployment,
-                    artifact: context.artifact.digest,
-                    issuer: selected.issuer,
-                }),
-            });
-            if (Object.keys(context.secrets).length > 0) {
-                try {
-                    await dependencies.bulkPutSecrets({
-                        projectDir: context.projectDir,
-                        configPath,
-                        secrets: { ...context.secrets },
-                    });
-                }
-                catch (cause) {
-                    return failed('configuration', progress({ provider, configuration: { kind: 'unknown' } }), cause);
-                }
-                try {
-                    observed = await dependencies.runWranglerDeploymentStatus({
-                        projectDir: context.projectDir,
-                        configPath,
-                        workerName: name,
-                    });
-                    requireCurrentDeployment(observed);
-                    provider = Object.freeze({
-                        kind: 'applied',
-                        evidence: Object.freeze({
-                            provider: 'cloudflare',
-                            deployment: observed.deployment,
-                            artifact: context.artifact.digest,
-                            issuer: selected.issuer,
-                        }),
-                    });
-                }
-                catch (cause) {
-                    return failed('readiness', progress({
-                        provider,
-                        configuration: {
-                            kind: 'applied',
-                            evidence: { names: Object.keys(context.secrets).sort() },
-                        },
-                    }), cause);
-                }
-            }
-            const configuration = Object.keys(context.secrets).length === 0
-                ? NONE
-                : Object.freeze({
-                    kind: 'applied',
-                    evidence: Object.freeze({ names: Object.keys(context.secrets).sort() }),
-                });
-            let release;
-            try {
-                release = assemble(context.artifact.build, selected);
-            }
-            catch (cause) {
-                return failed('release', progress({ provider, configuration }), cause);
-            }
-            try {
-                await dependencies.waitForReadiness(release);
-            }
-            catch (cause) {
-                return failed('readiness', progress({ provider, configuration }), cause, release);
-            }
-            return Object.freeze({
-                status: 'ready',
-                phase: 'complete',
-                progress: Object.freeze({ ...progress({ configuration }), provider }),
-                release,
-            });
-        },
+        deploy: (parameters, context) => deployCloudflare(parameters, context, dependencies),
         secretsFile: (parameters) => parameters.secrets,
     });
 }
-function partialProvider(cause, artifact) {
-    const applied = cause.applied;
-    if (applied?.deploymentVersion === undefined)
-        return Object.freeze({ kind: 'partial' });
-    let issuer;
-    if (applied.url !== undefined) {
-        try {
-            issuer = addressing(applied.url).issuer;
-        }
-        catch {
-            // The provider effect is known even when its printed URL is not admissible Addressing.
-        }
-    }
-    return Object.freeze({
-        kind: 'partial',
-        evidence: Object.freeze({
-            provider: 'cloudflare',
-            deployment: applied.deploymentVersion,
-            artifact: artifact.digest,
-            ...(issuer === undefined ? {} : { issuer }),
-        }),
-    });
-}
-function requireCurrentDeployment(observed, expectedVersion) {
-    if (observed.versions.length !== 1 ||
-        observed.versions[0].percentage !== 100 ||
-        (expectedVersion !== undefined && observed.versions[0].version !== expectedVersion)) {
-        throw new TypeError('Cloudflare current deployment is not one exact Worker version at 100%.');
-    }
-}
-function observeAddressing(artifact, deployedUrl, expectedWorker) {
-    const observed = addressing(deployedUrl);
-    if (artifact.addressing.kind === 'configured') {
-        if (observed.issuer !== artifact.addressing.addressing.issuer) {
-            throw new TypeError('Cloudflare deployed URL differs from configured Addressing.');
-        }
-        return observed;
-    }
-    if (artifact.addressing.claim !== expectedWorker) {
-        throw new TypeError('PreparedArtifact worker claim differs from the deployment target.');
-    }
-    const url = new URL(observed.issuer);
-    const labels = url.hostname.split('.');
-    if (url.protocol !== 'https:' ||
-        labels.length < 4 ||
-        labels[0] !== artifact.addressing.claim ||
-        labels.at(-2) !== 'workers' ||
-        labels.at(-1) !== 'dev') {
-        throw new TypeError('Cloudflare workers.dev URL does not satisfy its prepared worker claim.');
-    }
-    return observed;
-}
 function frontendRoutes(artifact) {
     const frontend = artifact.build.frontend;
     if (frontend === undefined || frontend.source.kind !== 'vite')
@@ -287,24 +123,6 @@ function frontendRoutes(artifact) {
             : [route.path])
         .sort());
 }
-function progress(input) {
-    return Object.freeze({
-        prerequisite: input.prerequisite ?? NONE,
-        provider: input.provider ?? NONE,
-        configuration: input.configuration ?? NONE,
-        installation: input.installation ?? NONE,
-    });
-}
-function failed(phase, progressValue, cause, release) {
-    const error = cause instanceof Error ? cause : new Error(String(cause));
-    return Object.freeze({
-        status: 'failed',
-        phase,
-        progress: progressValue,
-        error,
-        ...(release === undefined ? {} : { release }),
-    });
-}
 export async function waitForReadiness(verify, release) {
     const deadline = Date.now() + 90_000;
     let last;
@@ -320,4 +138,3 @@ export async function waitForReadiness(verify, release) {
     }
     throw last instanceof Error ? last : new Error('Cloudflare Release did not become ready.');
 }
-//# sourceMappingURL=adapter.js.map

package/dist/build/artifact.d.ts

@@ -1,9 +1,8 @@
 import type { ArtifactSource, PrepareContext } from '@astrale-os/sdk/deployment/adapter';
 import type { CloudflareParams } from '../params.js';
-/** Prepare one self-contained Worker bundle without provider mutation. */
+/** Prepare one revision Service and its stateless gateway without provider mutation. */
 export declare function artifact(params: CloudflareParams, context: PrepareContext): Promise<ArtifactSource>;
 export declare function materialize(root: string, files: readonly {
     readonly path: string;
     bytes(): Uint8Array;
 }[]): Promise<void>;
-//# sourceMappingURL=artifact.d.ts.map

package/dist/build/artifact.js

@@ -1,28 +1,31 @@
 import { material } from '@astrale-os/sdk/deployment/build';
 import { addressing } from '@astrale-os/sdk/deployment/release';
-import { copyFile, readFile, writeFile, mkdir, rm } from 'node:fs/promises';
+import { readFile, writeFile, mkdir, rm } from 'node:fs/promises';
 import { dirname, join, relative, resolve } from 'node:path';
 import { pathToFileURL } from 'node:url';
+import { SIGNING_IDENTITY_BINDING } from '../identity/binding.js';
+import { releaseNamespace, releaseWorkerName } from '../release/index.js';
 import { generateExecutionEntry } from './codegen/execution.js';
-import { ensureIdentity } from './codegen/identity.js';
+import { generateGatewayEntry } from './codegen/gateway.js';
 import { generateWranglerConfig } from './codegen/wrangler.js';
-import { resolveRouter, workerName } from './configuration.js';
+import { deploymentAddressing, resolveRouter, workerName } from './configuration.js';
 import { frontendFiles } from './frontend-v1.js';
 import { qualifyWorkerBundle } from './qualification.js';
 import { runWranglerBundle } from './wrangler-cli.js';
 const encoder = new TextEncoder();
-/** Prepare one self-contained Worker bundle without provider mutation. */
+/** Prepare one revision Service and its stateless gateway without provider mutation. */
 export async function artifact(params, context) {
     const stateDirectory = join(context.projectDir, '.astrale');
     const directory = join(stateDirectory, 'runtime');
     await mkdir(directory, { recursive: true });
-    await ensureIdentity(stateDirectory, context.build.schema.compiled.root.origin);
-    await copyFile(join(stateDirectory, 'identity.ts'), join(directory, 'identity.ts'));
     const runtimePath = resolve(context.projectDir, context.runtime.reference.path);
     const runtimeSpecifier = moduleSpecifier(relative(directory, runtimePath));
     const router = resolveRouter(params.router);
     const name = workerName(params, context.build.schema.compiled.root.origin);
-    const configuredIssuer = params.route === undefined ? params.host : `https://${params.route}`;
+    const revision = context.build.schema.compiled.root.revision;
+    const namespace = releaseNamespace(name);
+    const target = releaseWorkerName(revision);
+    const configuredIssuer = deploymentAddressing(params);
     const source = generateExecutionEntry({
         origin: context.build.schema.compiled.root.origin,
         runtimeSpecifier,
@@ -48,11 +51,12 @@ export async function artifact(params, context) {
             ...params.vars,
             ...(configuredIssuer === undefined ? {} : { WORKER_URL: configuredIssuer }),
         },
+        secretBindings: [SIGNING_IDENTITY_BINDING],
         ...(router === undefined
             ? {}
             : { router: { binding: router.binding, service: router.service } }),
         ...(params.wrangler === undefined ? {} : { wrangler: params.wrangler }),
-        selfBinding: true,
+        selfBinding: false,
     }));
     const output = join(directory, 'dist-prepare');
     await rm(output, { recursive: true, force: true });
@@ -71,14 +75,37 @@ export async function artifact(params, context) {
     });
     await admitBundle(emitted.bundlePath);
     const bundle = await readFile(emitted.bundlePath);
-    const deploymentConfig = (selfBinding) => generateWranglerConfig({
+    const gatewaySource = join(directory, 'gateway.gen.ts');
+    await writeFile(gatewaySource, generateGatewayEntry(revision));
+    const gatewayPrepareConfig = join(directory, 'wrangler.gateway.prepare.jsonc');
+    await writeFile(gatewayPrepareConfig, generateWranglerConfig({
         workerName: name,
-        main: './bundle/index.mjs',
+        main: './gateway.gen.ts',
         ...(params.route === undefined ? {} : { route: params.route }),
+        releases: { binding: 'RELEASES', namespace },
+        selfBinding: false,
+    }));
+    const gatewayOutput = join(directory, 'dist-gateway');
+    await rm(gatewayOutput, { recursive: true, force: true });
+    const gateway = await runWranglerBundle({
+        projectDir: context.projectDir,
+        configPath: gatewayPrepareConfig,
+        outDir: gatewayOutput,
+    });
+    await qualifyWorkerBundle({
+        metafilePath: gateway.metafilePath,
+        inputRoot: dirname(gatewayPrepareConfig),
+    });
+    await admitBundle(gateway.bundlePath);
+    const gatewayBundle = await readFile(gateway.bundlePath);
+    const releaseConfig = generateWranglerConfig({
+        workerName: target,
+        main: './bundle/index.mjs',
         vars: {
             ...params.vars,
             ...(configuredIssuer === undefined ? {} : { WORKER_URL: configuredIssuer }),
         },
+        secretBindings: [SIGNING_IDENTITY_BINDING],
         ...(context.build.frontend?.source.kind === 'vite'
             ? {
                 frontend: {
@@ -92,12 +119,20 @@ export async function artifact(params, context) {
             ? {}
             : { router: { binding: router.binding, service: router.service } }),
         ...(params.wrangler === undefined ? {} : { wrangler: params.wrangler }),
-        selfBinding,
+        selfBinding: false,
+    });
+    const gatewayConfig = generateWranglerConfig({
+        workerName: name,
+        main: './gateway/index.mjs',
+        ...(params.route === undefined ? {} : { route: params.route }),
+        releases: { binding: 'RELEASES', namespace },
+        selfBinding: false,
     });
     const files = [
-        { path: 'wrangler.jsonc', content: encoder.encode(deploymentConfig(true)) },
-        { path: 'wrangler.no-self.jsonc', content: encoder.encode(deploymentConfig(false)) },
+        { path: 'wrangler.release.jsonc', content: encoder.encode(releaseConfig) },
+        { path: 'wrangler.gateway.jsonc', content: encoder.encode(gatewayConfig) },
         { path: 'bundle/index.mjs', content: new Uint8Array(bundle) },
+        { path: 'gateway/index.mjs', content: new Uint8Array(gatewayBundle) },
         ...frontend.map((file) => ({
             path: `frontend/${file.path}`,
             content: file.bytes(),
@@ -142,4 +177,3 @@ function moduleSpecifier(input) {
     const normalized = input.split('\\').join('/');
     return normalized.startsWith('.') ? normalized : `./${normalized}`;
 }
-//# sourceMappingURL=artifact.js.map

package/dist/build/closure.d.ts

@@ -1,3 +1,2 @@
 /** Prove emitted Worker reachability excludes authoring, compilation, and broad Core Schema owners. */
 export declare function assertRuntimeClosure(metafilePath: string): Promise<void>;
-//# sourceMappingURL=closure.d.ts.map

package/dist/build/closure.js

@@ -20,4 +20,3 @@ export async function assertRuntimeClosure(metafilePath) {
         throw new Error(`Cloudflare Worker reaches build-side modules: ${forbidden.sort().join(', ')}.`);
     }
 }
-//# sourceMappingURL=closure.js.map

package/dist/build/codegen/execution.d.ts

@@ -11,4 +11,3 @@ export interface ExecutionCodegenOptions {
     };
 }
 export declare function generateExecutionEntry(options: ExecutionCodegenOptions): string;
-//# sourceMappingURL=execution.d.ts.map

package/dist/build/codegen/execution.js

@@ -23,19 +23,22 @@ import type { CloudflareAdapterBindings } from '@astrale-os/adapter-cloudflare/w
 
 import { cloudflareWorkerEntry } from '@astrale-os/adapter-cloudflare/worker'
 import runtime from ${JSON.stringify(options.runtimeSpecifier)}
-import { PRIVATE_JWK } from './identity.js'
+import { decodeSigningIdentity, runtimeBindings } from '@astrale-os/adapter-cloudflare/worker'
 
-type WorkerEnv = CloudflareEnv & CloudflareAdapterBindings
+type WorkerEnv = CloudflareEnv & CloudflareAdapterBindings & {
+  readonly ASTRALE_SIGNING_IDENTITY: string
+}
+type RuntimeEnv = Omit<WorkerEnv, 'ASTRALE_SIGNING_IDENTITY'>
 const MATERIAL = ${JSON.stringify(options.material)} as const satisfies BuildMaterial
 ${routerPredicate}
-export default cloudflareWorkerEntry<WorkerEnv>()({
+export default cloudflareWorkerEntry<WorkerEnv, RuntimeEnv>()({
   runtime,
   material: MATERIAL,
-  privateKey: PRIVATE_JWK,
+  privateKey: (env) => decodeSigningIdentity(env.ASTRALE_SIGNING_IDENTITY),
+  resolveEnvironment: runtimeBindings,
   resolveUrl: (env, requestOrigin) => env.WORKER_URL ?? env.IDENTITY_ISS ?? requestOrigin,
   ${options.providerAssignedWorker === undefined ? '' : `providerAssignedWorker: ${JSON.stringify(options.providerAssignedWorker)},`}
   selfBinding: (env) => env.SELF,${routeSubrequest}
 })
 `;
 }
-//# sourceMappingURL=execution.js.map

package/dist/build/codegen/gateway.d.ts

@@ -0,0 +1 @@
+export declare function generateGatewayEntry(revision: string): string;

package/dist/build/codegen/gateway.js

@@ -0,0 +1,7 @@
+export function generateGatewayEntry(revision) {
+    return `// AUTO-GENERATED by @astrale-os/adapter-cloudflare — do not edit.
+import { cloudflareGatewayEntry } from '@astrale-os/adapter-cloudflare/worker'
+
+export default cloudflareGatewayEntry({ current: ${JSON.stringify(revision)} })
+`;
+}

package/dist/build/codegen/merge.d.ts

@@ -17,4 +17,3 @@
  * the caller (`generateWranglerConfig`), not here — this stays a generic merge.
  */
 export declare function deepMergeConfig(base: Record<string, unknown>, overlay: Record<string, unknown>): Record<string, unknown>;
-//# sourceMappingURL=merge.d.ts.map

package/dist/build/codegen/merge.js

@@ -88,4 +88,3 @@ function isPlainObject(v) {
 function isPrimitive(v) {
     return v === null || (typeof v !== 'object' && typeof v !== 'function');
 }
-//# sourceMappingURL=merge.js.map

package/dist/build/codegen/wrangler.d.ts

@@ -25,8 +25,15 @@ export interface WranglerCodegenOptions {
     };
     /** Plain (non-secret) vars to bake in. */
     vars?: Record<string, string>;
+    /** Secret binding names required by generated Worker code. */
+    secretBindings?: readonly string[];
     /** Add the SELF service binding (autobinding). */
     selfBinding: boolean;
+    /** Bind the stable gateway to its private revision namespace. */
+    releases?: {
+        readonly binding: string;
+        readonly namespace: string;
+    };
     /**
      * Add a service binding to a router Worker for instance-host subrequest
      * routing (see `CloudflareParams.router`). Pairs with the worker
@@ -46,4 +53,3 @@ export interface WranglerCodegenOptions {
     wrangler?: Record<string, unknown>;
 }
 export declare function generateWranglerConfig(opts: WranglerCodegenOptions): string;
-//# sourceMappingURL=wrangler.d.ts.map

package/dist/build/codegen/wrangler.js

@@ -57,6 +57,12 @@ export function generateWranglerConfig(opts) {
     if (opts.vars && Object.keys(opts.vars).length > 0) {
         config.vars = opts.vars;
     }
+    if (opts.secretBindings && opts.secretBindings.length > 0) {
+        config.secrets = { required: [...opts.secretBindings] };
+    }
+    if (opts.releases !== undefined) {
+        config.dispatch_namespaces = [opts.releases];
+    }
     const merged = opts.wrangler ? mergeUserConfig(config, opts.wrangler) : config;
     return JSON.stringify(merged, null, 2) + '\n';
 }
@@ -68,6 +74,7 @@ const ADAPTER_OWNED_KEYS = [
     'routes',
     'compatibility_date',
     'version_metadata',
+    'secrets',
 ];
 /**
  * Deep-merge the dev's raw wrangler overlay over the generated config, after
@@ -83,4 +90,3 @@ function mergeUserConfig(base, user) {
     }
     return deepMergeConfig(base, user);
 }
-//# sourceMappingURL=wrangler.js.map

package/dist/build/configuration.d.ts

@@ -1,4 +1,5 @@
 import type { CloudflareParams } from '../params.js';
+export declare function deploymentAddressing(parameters: CloudflareParams): string | undefined;
 export declare function workerName(parameters: CloudflareParams, origin: string): string;
 export declare function resolveRouter(input: CloudflareParams['router']): {
     readonly binding: string;
@@ -6,4 +7,3 @@ export declare function resolveRouter(input: CloudflareParams['router']): {
     readonly hostSuffix: string;
     readonly minLabels: number;
 } | undefined;
-//# sourceMappingURL=configuration.d.ts.map

package/dist/build/configuration.js

@@ -1,4 +1,16 @@
-const WORKER_NAME = /^[a-z0-9][a-z0-9-]*$/u;
+import { addressing } from '@astrale-os/sdk/deployment/release';
+import { createHash } from 'node:crypto';
+const WORKER_NAME = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/u;
+export function deploymentAddressing(parameters) {
+    const routed = parameters.route === undefined ? undefined : addressing(`https://${parameters.route}`).issuer;
+    if (parameters.addressing === undefined)
+        return routed;
+    const configured = addressing(parameters.addressing).issuer;
+    if (routed !== undefined && configured !== routed) {
+        throw new TypeError('Cloudflare route and addressing identify different origins.');
+    }
+    return configured;
+}
 export function workerName(parameters, origin) {
     if (parameters.workerName !== undefined) {
         if (!WORKER_NAME.test(parameters.workerName) || parameters.workerName.length > 63) {
@@ -6,11 +18,14 @@ export function workerName(parameters, origin) {
         }
         return parameters.workerName;
     }
-    return origin
+    const readable = origin
         .toLowerCase()
         .replace(/[^a-z0-9]+/gu, '-')
-        .slice(0, 54)
-        .replace(/^-+|-+$/gu, '');
+        .slice(0, 12)
+        .replace(/^-+|-+$/gu, '') || 'domain';
+    const hexadecimal = createHash('sha256').update(origin).digest('hex');
+    const identity = BigInt(`0x${hexadecimal}`).toString(36).padStart(50, '0');
+    return `${readable}-${identity}`;
 }
 export function resolveRouter(input) {
     if (input === false)
@@ -23,4 +38,3 @@ export function resolveRouter(input) {
         minLabels: value.minLabels ?? 4,
     });
 }
-//# sourceMappingURL=configuration.js.map

package/dist/build/frontend-v1.d.ts

@@ -14,4 +14,3 @@ export declare function startFrontend(input: {
     readonly projectDir: string;
     readonly onLog?: (line: string) => void;
 }): Promise<FrontendDevHandle | undefined>;
-//# sourceMappingURL=frontend-v1.d.ts.map

package/dist/build/frontend-v1.js

@@ -131,4 +131,3 @@ function stop(child) {
         child.kill('SIGTERM');
     });
 }
-//# sourceMappingURL=frontend-v1.js.map

package/dist/build/index.d.ts

@@ -3,5 +3,6 @@ export { resolveRouter, workerName } from './configuration.js';
 export { frontendFiles, startFrontend, type FrontendDevHandle } from './frontend-v1.js';
 export { qualifyWorkerBundle } from './qualification.js';
 export { assertSingletonRuntimeRoots } from './roots.js';
-export { bulkPutSecrets, runWranglerBundle, runWranglerDeploy, runWranglerDeploymentStatus, runWranglerDev, runWranglerTypes, } from './wrangler-cli.js';
-//# sourceMappingURL=index.d.ts.map
+export { signingIdentity } from '../identity/source.js';
+export { signingIdentitySecrets } from '../identity/secret.js';
+export { runWranglerBundle, runWranglerDeploy, runWranglerDeploymentStatus, runWranglerDev, runWranglerTypes, } from './wrangler-cli.js';